Follow-up: Supermarket Fridges Hacked Across Seven European Countries, Temperatures Hit 50°C as Food Spoils

In the early hours of Monday, November 2, supermarket refrigeration systems in seven European countries were hit by another cyberattack: attackers remotely switched the evaporators of networked fridges and freezers into defrost mode, pushing temperatures inside some units to 50 degrees Celsius (122 degrees Fahrenheit), affecting more than 115 stores and forcing them to throw away large quantities of spoiled food. It was the second wave of such attacks in three weeks — in October, about 700 French supermarkets were hit. As authorities, companies and regulators disclosed more details, a fuller picture emerged, along with a parallel investigation in the United States and a set of long-public vulnerabilities in the equipment involved.

Stephan Moelans, head of Sabcobel, the Belgian company that operates Delhaize's refrigeration systems, told the Belga news agency it was a cyberattack: the evaporators of the affected units had been switched to defrost mode, and technicians had been disconnecting the installations from the network since 1 a.m. An ICA franchise store in Stockholm said the attack occurred at 2 a.m. but was only noticed hours later, with all of its freezers reaching 50 degrees. "Everything is destroyed," said Engla Ingwall, the store's sales manager.

Belgium and Luxembourg were hit hardest. Dutch retailer Ahold Delhaize said an overnight "IT incident" had affected the fridges and freezers of dozens of its Delhaize stores in Belgium and Luxembourg; European media put the number of affected Delhaize stores at around 40. Spokesperson Sarah De Meester said the chain detected the temperature rise in its cooling systems on Monday and was investigating. IKEA also had one store hit, in Mons, Belgium. A butcher chain store in Hove, south of Antwerp, had a freezer raised to 18 degrees; founder Luc De Laet said about 15,000 euros of meat was ruined. The BBC reported that a Delhaize store in Hoeilaart, near Brussels, estimated its losses at more than 100,000 euros. Belgian media, tallying the chains' reports, put the country's affected stores at about 60 in total.

In Sweden, Coop said 7 of its 800 stores had their cooling systems tampered with in a cyber incident, and that Danfoss, the Danish refrigeration equipment maker, was among its suppliers. ICA said a limited number of its stores were affected overnight; one ICA Kvantum store in Sjöbo, in southern Sweden, said on Facebook that its fridges and freezers had been hacked and set to 50 degrees. In Estonia, public broadcaster ERR reported that attackers had accessed a computer controlling a client's refrigeration system at technology firm Kitman Coldtech and raised the temperature to 50 degrees. In the Netherlands, Danfoss told public broadcaster NOS that at least 17 facilities using its systems, including butcher shops and frozen-product storage sites, were hit by an attack of the same kind overnight. In Ireland, food wholesaler Musgrave said a cyber incident had affected refrigeration systems in 13 of its SuperValu stores, forcing it to remove some chilled and frozen products from sale; its monitoring systems had alerted it to the problem and its investigation was ongoing. Stores run by Finland's Kesko also reported similar failures. There were also reports of similar problems at stores in Germany, Portugal, Romania and Italy, but these had not been confirmed by officials or companies in those countries.

Christophe Hansen, the European Commissioner for Agriculture and Food, said: "They are a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it - a warning that we must take seriously." He added: "The repeated occurrence of these cyberattacks is deeply concerning." Katrien Eggers, spokesperson for Belgium's Centre for Cybersecurity, said it was not known who was behind the attack. John Billow, head of Sweden's national cybersecurity centre, said the centre was working on several incidents affecting grocery stores across the country and could not speculate on who was responsible. No group has claimed responsibility for either wave of attacks, and authorities have not publicly identified any perpetrator.

There is also a parallel line of investigation in the United States. Reuters reported on October 29 that the Pentagon is treating a string of late-August refrigeration failures at at least six U.S. military commissaries, which spoiled large quantities of food, as a suspected cyberattack, with the Defense Criminal Investigative Service leading the probe and U.S. investigators working with French law enforcement; the Pentagon has not confirmed that hackers were responsible. On November 2, the defense publication Nextgov/FCW reported that, according to two people familiar with the matter, U.S. officials suspect Iran-linked hackers were behind the intrusions - an assessment presented without public evidence that could change as the investigation proceeds.

The new attack used the same method as the one in France on the night of October 11. Hackers remotely seized control of refrigeration controllers at supermarkets across France; Finance Minister Roland Lescure later told lawmakers that about 700 of the country's roughly 10,000 supermarkets were affected. Temperatures in some units rose to 50 degrees, causing fires as well as heavy food losses, and Reuters reported at the time that losses were estimated in the tens of millions of euros. The Paris prosecutor's office opened an investigation into what it called a large-scale cyberattack, and France's cybersecurity agency ANSSI issued alerts identifying the affected controllers as mainly Danfoss products, along with Copeland and Dixell systems - many of them older, end-of-life models that no longer receive security updates but remained exposed to the internet.

CERT-FR, the response centre of France's national cybersecurity agency ANSSI, issued alert CERTFR-2026-ALE-012 on October 12 and updated it on October 13 and 16, naming four affected controller product lines: Danfoss's AK-SM series, Danfoss's AK-SC series, Copeland xweb and Dixell xweb. The alert states plainly that exposing the management interface of such equipment directly to the internet is contrary to good practice. It warned that attack campaigns against these devices were probably still under way, that end-of-life models left online faced a very high probability of compromise, and that a factory reset alone was not enough: it removes the attacker's foothold but leaves the device just as vulnerable. Danfoss confirmed that the units hit in France included legacy models such as the AK-SM 800, which went out of support in 2021, and the AK-SC 355, discontinued in 2016.

The flaws in this equipment were already on the public record. In August, Team82, the research arm of industrial cybersecurity firm Claroty, published a study of Danfoss's AK-SM 800A system manager and presented it at the DEF CON conference in Las Vegas: the device's web management interface contained a hidden 'code-of-the-day' login that derives a password from the current date and bypasses normal authentication (CVE-2025-41450), along with a command-injection flaw (CVE-2025-41451) and a configuration-injection flaw that can cause denial of service (CVE-2025-41452). From Censys scanning data, the researchers counted 2,765 of these management interfaces exposed directly to the internet. Danfoss has released firmware R4.3.1 fixing all three flaws. Investigators have not, however, confirmed which vulnerability, if any, was used to break into the systems in France or in this week's attacks.

At least some of the units hit on Monday used Danfoss technology that was also targeted in France, and the company said it had been working with customers to implement fixes. Tom Hegel, a researcher at cybersecurity firm SentinelOne, said such attacks were typically linked to extortion, political motives or nation-state operations, with the absence of financial demands in the recent cases pointing instead to sabotage.

Who bears the losses is also in dispute. Insurance Business magazine reported that the attacks fall into a gap between two kinds of cover: cyber policies often exclude physical loss, while property policies with spoilage cover may contain cyber exclusions. Broker Lockton has pointed to EUR270,000 in stock losses at just two French stores. The head of Sabcobel, which operates Delhaize's refrigeration systems, also said the affected units needed physical modifications, not just software updates - a real expense for retailers still running legacy controllers.

Related: Thousands of Supermarket Fridges Hacked Across France, Major Chains Hit

Related: Pentagon Treats August Freezer Failures at U.S. Bases as Suspected Cyberattack, Officials Say

Related: Suspected Cyberattacks Hit Supermarket Freezers Across Europe: More Than 115 Stores Affected, Some Freezer Temperatures Raised Above 50 Degrees Celsius

(Source: Reuters, Associated Press, CERT-FR)

Source: Reuters, Associated Press, CERT-FR

Published by GSM · USA (original Chinese edition)

Photo: 图：超市冷冻货架（资料图）。摄影：Phillip Pessar，CC BY 2.0，经 Wikimedia Commons。 / Photo: A supermarket freezer aisle (file photo). Photo by Phillip Pessar, CC BY 2.0, via Wikimedia Commons.

Latest in World

MFA: German and Swiss Presidents' Successful Visits Set a Good Example for China-Europe Relations2026-11-02Chip Shortage Disrupts Fiat Production in Italy: Stellantis Says Disruption May Last Through November and December, Pomigliano and Mirafiori Plants Face Halts2026-11-02